Spring 3.0安全性 - 授權與認證

Question

我是Spring的新手，我的要求是我不想用用戶名和密碼對用戶進行身份驗證。 的用戶身份驗證是一些其他的應用和我的應用程序獲得與folloing細節要求：

1. 用戶名
2. 角色

我只是想使用Spring Security根據固定的頁面請求中的角色。 我已經考慮編寫UserDetailService，但只添加請求數據，Spring仍然要求提供認證信息。 後來我想過寫類似如下：

public class UserLogin { 

/* 
@Resource(name = "userDetailsService") 
private UserDetailsService userDetailsService; 
*/ 

@Resource(name = "authenticationManager") 
private AuthenticationManager authenticationManager; 

public boolean login(UserEntity user) { 

    //UserDetails ud = userDetailsService.loadUserByUsername(username); 

    Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(); 
    for (String role : user.getAuthorities()) { 
     authorities.add(new GrantedAuthorityImpl(role)); 
    } 

    UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword(), authorities); 

    try { 
     Authentication auth = authenticationManager.authenticate(token); 

     SecurityContext securityContext = new SecurityContextImpl(); 

     // Places in ThredLocal for future retrieval 
     SecurityContextHolder.setContext(securityContext); 
     SecurityContextHolder.getContext().setAuthentication(auth); 

    } catch (AuthenticationException e) { 
     return false; 
    } 

    return true; 
} 
} 

上午我在正確的方向前進。如果是這樣，如何配置整個事情..在spring-xml中。

Answer 1

您處於所謂的預認證方案中，在此方案中，您將Spring Security配置爲僅授權訪問，而不是授權訪問。請參閱http://static.springsource.org/spring-security/site/docs/3.0.x/reference/preauth.html。這是一個完整的配置，您需要實施AbstractPreAuthenticatedProcessingFilter來認證您的認證方案的UserPrincipal，以及上面提到的自定義UserDetailsService。

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans 
xmlns:security="http://www.springframework.org/schema/security" 
xmlns:beans="http://www.springframework.org/schema/beans" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 

<security:global-method-security secured-annotations="enabled" /> 

<beans:bean id="preAuthenticatedProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" /> 

<security:http auto-config="false" entry-point-ref="preAuthenticatedProcessingFilterEntryPoint"> 
    <security:custom-filter position="PRE_AUTH_FILTER" ref="myCustomPreAuthFilter" /> 
</security:http> 

<beans:bean id="myCustomPreAuthFilter" class="com.mypackage.MyCustomPreAuthFilter"> 
    <beans:property name="authenticationManager" ref="authenticationManager" /> 
</beans:bean> 

<security:authentication-manager alias="authenticationManager"> 
    <security:authentication-provider ref="preauthAuthProvider" /> 
</security:authentication-manager> 

<beans:bean id="preauthAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> 
    <beans:property name="preAuthenticatedUserDetailsService"> 
     <beans:bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"> 
      <beans:property name="userDetailsService" ref="myCustomUserDetailsService"/> 
     </beans:bean> 
    </beans:property> 
</beans:bean>